Gap analysis
We assess your current posture against ISO 27001, NIST, CIS, NIS2 or SOC 2 and deliver a prioritised remediation roadmap, with evidence and policy review, maturity scoring by domain and an action plan.
Services
From gap analysis to audit, and the training in between
Take one service on its own or combine them. Before we start, you get a statement of works that sets out the scope, the days and the deliverables.
ISO 27001
Information security
Implementation support
We help you design and implement policies, processes and technical controls with minimal disruption, including policy authoring, risk and asset management setup and control guidance.
Internal and external audit preparation
Mock audits, evidence checklists and auditor-style coaching, covering audit scope definition, evidence library readiness and nonconformity remediation.
Employee training
Role-based security awareness, workshops and simulations, with effectiveness tracking, so people know what is expected of them in their own roles.
ISO 22301
Business continuity
Gap analysis
We measure your resilience against ISO 22301, or the specification you choose, and report where the gaps are.
Business impact assessment
We identify your critical activities and how the effect of a disruption escalates over time.
Strategies and solutions
Scenario-based risk assessment and selection of resilience strategies that fit how you operate.
Business continuity plans and testing
Tailored plans, plus tabletop or live testing to verify that they work when they are needed.
Why us
Security that fits how you operate
XM Security helps organisations of any size design, implement and improve information security and business continuity management systems. Our experience covers technology, finance, healthcare and the public sector.
We fit risk-driven security into your operations so that it supports the work and does not become compliance overhead. We also work with NIST, CIS, NIS2 and SOC 2.
Certified lead implementer and auditor
ISO/IEC 27001:2022 and ISO 22301:2019 expertise, for both implementation and audit.
Almost a decade of experience
From gap analysis through to certification and the support that follows it.
Risk-driven approach
Controls are chosen by risk and tailored to your organisation, with what matters most first.
On-time certification readiness
We plan back from your audit dates and keep progress visible along the way.
Straight answers
What to expect from us
Each finding states the requirement, the evidence and the finding.
We do not certify anyone
Certification comes from a certification body after its own audit. Our job is to get you ready for it and tell you plainly where you stand.
We do not promise a pass
No consultant can. We can show you each gap, the evidence for it and what would close it.
We do not sell on fear
You will get risks described in proportion, with what matters most first.
We write so your team can act
Reports lead with the answer and end with the next step: who, what and by when.
“Dan guided us through ISO27001 certification in a regulated healthcare setting with professionalism and pragmatic expertise. His combined knowledge of security and data privacy ensured a smooth certification process and a sustainable ISMS for a growing business. We continue to rely on XM Security for ongoing support and would highly recommend them to any organisation seeking assistance with ISO27001 implementation and ongoing certification.”
Jeremy L., Co-Founder, HealthPass
Contact
Tell us what you need and when you need it by
Send a few lines about your organisation, the standard you are working to and any audit dates. We will reply with questions or a proposed scope.